Malware on Untrusted Network

SANS ISC Diary - LausivLoader analysis, or how to pass data between malware stages

Jan Kopriva — Thu, 17 Sep 2026 16:55:00 +0100

A new Diary of mine was published today on the SANS Internet Storm Center website. In this one, we’ll take a look at the LasuvivLoader malware, and an interesting way of passing data between infection stages, which this loader takes advantage of…

SANS ISC Diary - Another day, another malicious JPEG

Jan Kopriva — Mon, 23 Feb 2026 15:35:00 +0100

A new Diary of mine was published today on the SANS Internet Storm Center website. In this one, we’ll take a look at a recent malspam campagin delivering a multi-stage infection chain involving a JScript downloader, WMI-spawned PowerShell, and an in-memory .NET assembly extracted from a JPEG file…

SANS ISC Diary - Script obfuscation using multiple instances of the same function

Jan Kopriva — Mon, 05 Aug 2024 08:15:00 +0100

A new Diary of mine was published today on the SANS Internet Storm Center website. In this one, we’ll take a look at an interesting script obfuscation technique…

SANS ISC Diary - Computer viruses are celebrating their 40th birthday (well, 54th, really)

Jan Kopriva — Tue, 06 Feb 2024 10:00:00 +0100

A new Diary of mine was published today on the SANS Internet Storm Center website. In this one, we’ll take a look at an interesting anniversary related to computer viruses…

SANS ISC Diary - Interesting large and small malspam attachments from 2023

Jan Kopriva — Wed, 03 Jan 2024 15:00:00 +0100

A new Diary of mine was published today on the SANS Internet Storm Center website. In this one, we’ll take a look at the largest and smallest malware samples, that my malspam traps caught last year…

SANS ISC Diary - From small LNK to large malicious BAT file with zero VT score

Jan Kopriva — Thu, 03 Aug 2023 18:30:00 +0100

A new Diary of mine was published today on the SANS Internet Storm Center website. In this one, we’ll take a look at a malicious BAT file which was used in a phishing campaign last week and according to VirusTotal is still being detected as benign by all anti-virus engines it has access to…

Malware analysis - 'video write-up' of one of the ECSC 2021 challenges

Jan Kopriva — Tue, 21 Jun 2022 08:25:00 +0100

I published a new video on the Untrusted Network YouTube channel today, which shows one possible solution for a “malware analysis task” which I prepared for the final round of last year’s European Cyber Security Challenge. If you would like to take a closer look at the multi-stage “malware” which contestants in the ECSC 2021 had to analyze, or if you would like to try to analyze the sample yourself, now you have a chance to do so - you will find further information in the following video.

The video is also available in a Czech language version.

SANS ISC Diary - What is the simplest malware in the world?

Jan Kopriva — Fri, 06 May 2022 09:20:00 +0100

A new Diary of mine was published today on the SANS Internet Storm Center website. In this one, we’ll take a look at what might be the simplest malware in the world…

List of free online malware analysis sandboxes v1.7

Jan Kopriva — Wed, 04 Aug 2021 08:55:00 +0200

Since the online malware sandbox landscape has changed somewhat over the last six months, I have updated my list of most useful sandboxes to reflect these changes. One improvement that deserves a special mention was a significant increase in number of supported operating systems by the Hatching Triage platform…

As always, you may find the current version here.

SANS ISC Diary - Architecture, compilers and black magic, or 'what else affects the ability of AVs to detect malicious files'

Jan Kopriva — Wed, 09 Jun 2021 13:25:00 +0200

A new Diary of mine was published today on the SANS Internet Storm Center website. In this one, we’ll take a look at how the use of a compiler affects the ability of anti-malware tools to detect malicious code…

SANS ISC Diary - All your Base are...nearly equal when it comes to AV evasion, but 64-bit executables are not

Jan Kopriva — Thu, 27 May 2021 11:30:00 +0200

A new Diary of mine was published today on the SANS Internet Storm Center website. In this one, we’ll take a look at the difference (or lack thereof) different binary-to-text encodings make when it comes to anti-malware evasion…

SANS ISC Diary - Malspam with Lokibot vs. Outlook and RFCs

Jan Kopriva — Tue, 06 Apr 2021 18:30:00 +0200

A Diary of mine was published today on the SANS Internet Storm Center website. In it, we’ll take a look at an interesting malspam message carrying the Lokibot infostealer and also causing quite unusual behavior in Outlook…

SANS ISC Diary - 50 years of malware? Not really. 50 years of computer worms? That's a different story...

Jan Kopriva — Tue, 16 Mar 2021 08:20:00 +0100

A Diary of mine was published today on the SANS Internet Storm Center. In this one, we take a look at Creeper, the first computer worm, which was created 50 years ago - according to some sources, on this very day in 1971…

SANS ISC Diary - Qakbot in a response to Full Disclosure post

Jan Kopriva — Tue, 23 Feb 2021 11:30:00 +0100

A Diary of mine was published today on the SANS Internet Storm Center. In this one, we take a look at an interesting e-mail message carrying Qakbot downloader, which appeared to be sent in a response to a historical Full Disclosure mailing list post…

SANS ISC Diary - Agent Tesla hidden in a historical anti-malware tool

Jan Kopriva — Thu, 11 Feb 2021 08:20:00 +0100

A Diary of mine was published today on the SANS Internet Storm Center. In this one, we take a look at an interesting sample of Agent Tesla, which was hidden in the code of a legitimate historical anti-malware tool…

SANS ISC Diary - From a small BAT file to Mass Logger infostealer

Jan Kopriva — Mon, 04 Jan 2021 15:50:00 +0100

A Diary of mine was published today on the SANS Internet Storm Center. In this one, we take a look at an interesting BAT file from 2020, which turned out to be a downloader for the Mass Logger infostealer.

SANS ISC Diary - A blast from the past - XXEncoded VB6.0 Trojan

Jan Kopriva — Fri, 04 Sep 2020 09:35:00 +0200

A Diary of mine was published today on the SANS Internet Storm Center. In this one, we take a look at a campaign in which the malicious actors decided to go reall “old school” when it comes to file formats they would use.

SANS ISC Diary - Definition of 'overkill' - using 130 MB executable to hide 24 kB malware

Jan Kopriva — Fri, 14 Aug 2020 14:20:00 +0200

A Diary of mine was published today on the SANS Internet Storm Center. In this one, we take a look at a 130 MB EXE carrying within it a 24 kB malicious payload.

Update of overview of free online malware analysis sandboxes

Jan Kopriva — Sat, 30 May 2020 13:30:00 +0200

Since there have been some small changes in the free online malware analysis sandbox landscape over the last couple of months, I’ve updated the comparison table to reflect them. You may find the new 1.2 version here.

History of Malware - Episode 1: Origins of Malware (1948 - 1979)

Jan Kopriva — Mon, 11 May 2020 09:35:00 +0200

I decided to start a YouTube series on the History of Malware and the first video was published today.

In this episode we’ll take a look at where malware began. We’ll discuss the first theoretical works by John von Neumann, the origins of the terms ‘virus’ and ‘worm’ in relation to malware and the early experiments in distributed computation that gave birth to the first computer worms. If you’d like to learn more about the subjects, you may find links for the relevant sources under the video.

John von Neumann - The General and Logical Theory of Automata
http://physics.bu.edu/~pankajm/PY571/HixonsymposiumVonNeumaan.pdf

John von Neumann - Theory of Self-Reproducing Automata
http://www.arise.mae.usp.br/wp-content/uploads/2018/03/Theory-of-self-reproducing-automata.pdf
https://archive.org/details/theoryofselfrepr00vonn_0/mode/2up

Lionel Penrose - Self-Reproducing Machines
http://fab.cba.mit.edu/classes/865.18/replication/Penrose.pdf
https://wellcomelibrary.org/item/b20219222

Frederick G. Stahl - 1960 – the first artificial universe complex artificial life in a Darwinian world
http://archive.computerhistory.org/resources/access/text/2017/02/102724826-05-01-acc.pdf

M. D. McIlroy, R. Morris, V. A. Vyssotsky - Letter to C. A. Lang about Darwin
https://www.cs.dartmouth.edu/~doug/darwin.pdf

The Jargon File 4.2.2
https://vanderworp.org/wp-content/uploads/2019/06/jargon.pdf

Fork bombs - Wikia
https://malware.wikia.org/wiki/Fork_Bomb

Numberphile - Does John Conway hate his Game of Life?
https://www.youtube.com/watch?v=E8kUJL04ELA

Gregory Benford - The Scared Man
http://www.gregorybenford.com/extra/the-scarred-man-returns/

Jordan Spencer Cunningham - Q&A with Ray Tomlinson on Creeper “Virus”
https://nerdology.org/2014/11/qa-with-ray-tomlinson-on-creeper/

Veith Risak - Selbstreproduzierende Automaten mit minimaler Informationsübertragung
https://web.archive.org/web/20080305093506/http://www.cosy.sbg.ac.at/~risak/bilder/selbstrep.html

Cicatrix - Interview with Q The Misanthrope
http://web.archive.org/web/20080406223546/http:/vx.netlux.org/lib/static/vdat/ivqmisan.htm

Peter G. Neumann - The Risk Digest Volume 6 Issue 53
http://catless.ncl.ac.uk/Risks/6.53.html#subj4

John Walker - The Animal Episode
https://www.fourmilab.ch/documents/univac/animal.html

PARC History
https://web.archive.org/web/20070711093550/http://www.parc.xerox.com/about/history/default.html

John F. Shoch and Jon A. Hupp - The "Worm" Programs Early Experience with a Distributed Computation
http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.137.9511&rep=rep1&type=pdf

SANS ISC Diary - Agent Tesla delivered by the same phishing campaign for over a year

Jan Kopriva — Tue, 28 Apr 2020 08:45:00 +0200

A Diary of mine was published today on the SANS Internet Storm Center. In this one, we take a look at a phishing campaign that has been running almost unchanged for more than a year and seems to be distributing exclusively Agent Tesla.

Overview of free online malware analysis sandboxes

Jan Kopriva — Fri, 13 Mar 2020 08:14:41 +0100

This page contains a list of freely accessible online malware sandboxes and analytical platforms that I currently find most useful, along with a short overview of their capabilities. The list is (and it is meant to be) non-exhaustive, but if you know of any sandbox which is not mentioned but offers interesting features, feel free to let me know about it.

If you’d like to use the table in a presentation or share it on some other site, there is a PNG version bellow to make it easier.

Current version: 1.9 (3/2023)

Name	Interactive	OS	Max. runtime duration	Max input size	File number limits	URL submission	API access	Requires registration	Note
Amnpardaz SandBox	✘	XP SP2	Not specified	20 MB	Not specified	✘	✘	Requires an e-mail address for each analysis
Any.Run	✔	W7 32bit	300 seconds	16 MB	✘	✔	✘	✔
CAPEv2 Sandbox	✘	W7 32bit W7 64bit	Not specified	30 MB	Limits for API use	✘	✔	✘	* Offers PCAP analysis as well
Hatching Triage	✔	W7 64bit W10 64 bit macOS 10.15 64 bit Ubuntu 18.04 64 bit Linux MIPS Android 9 32 bit Android 10 64 bit Android 11 64 bit	1800 seconds	No limit	✘	✔	✔	✔	* 1 GB+ file sizes supported
Hybrid Analysis	✘	W7 32bit W7 64bit W10 64bit Ubuntu 16.04 64 bit Ubuntu 20.04 64 bit Android (static analysis only)	360 seconds	100 MB	Limits for API use	✔	✔	Registration required for API use
Intezer Analyze	✘	N/A	N/A	16 MB	10 files per month	✘	✘	✔	* Analysis of multiple executable and document file types * Performs very complex static analysis * Dynamic analysis performed by CAPE
IRIS-H Digital Forensics	✘	N/A	N/A	10 MB	Not specified	✘	✘	✘	* Analysis of malicious documents (Office formats, PDFs and LNKs) * Not a "true" sandbox - only static analysis, but worth mentioning
VirusTotal	✘	Unspecified	N/A	650 MB	Limits for API use	✔	✔	✘	* Automated multisandbox analysis of submitted samples

Direct URL: https://untrustednetwork.net/images/misc/free-malware-analysis-sandboxes-overview-current.png

Overview of free online malware analysis sandboxes – 2020 edition

Jan Kopriva — Thu, 12 Mar 2020 08:33:11 +0100

UPDATE 13/3/2020: Interactive (and hopefully current) version of the table may be found here.

Whether your work has anything to do with security monitoring, malware analysis, incident response, or just general IT administration, you’ve probably come across VirusTotal. It is an invaluable tool when it comes to identifying malicious code, however sometimes we need to dig a bit deeper than just getting a “detection score” for a potentially dangerous file. In such instances, we may turn to free online sandboxes (or paid or local ones, if we have access to them, but let’s assume we don’t), which can provide us with more detailed information about the behavior of our file by executing or opening it in a virtual environment and monitoring its activities.

There have been many such tools over the years. But since some of the old ones are not working anymore (malwr.com to name one), while others appeared only relatively recently, I thought it might be interesting to take a look at what free sandboxes and analytical platforms are available to us at the beginning of 2020 and what their features are.

After going through all the free online sandboxes I could find, I picked out nine, which I believe are most useful, and summarized their features in the following table. I should mention that I intentionally didn’t put in it “specialized” sandboxes, such as AMAaaS, as I was mainly going for general-use platforms. Although the table is therefore far from being exhaustive, I think it may provide a useful quick reference to what you can get and where you can get it if you need to analyze (potentially) malicious files under specific conditions.

It should be noted that at the time of writing, none of the free sandboxes mentioned bellow support private submissions. This means that any uploaded files may be accessible to other users and/or organizations and it would therefore be unwise to upload anything sensitive to any of the platforms.

SANS ISC Diary - Analysis of a triple-encrypted AZORult downloader

Jan Kopriva — Mon, 03 Feb 2020 07:45:10 +0100

A Diary of mine was published today on the SANS Internet Storm Center. In this one we take a look at analysis of an interesting malicious document which turned out to be AZORult downloader. What made it stand out - among its other aspects - were 3 layers of home-grown encryption…

EDIT 04/02/2020: Tom from Threat Post liked the diary and wrote an article based on it - you may find it here.

SANS ISC Diary - Picks of 2019 malware - the large, the small and the one full of null bytes

Jan Kopriva — Thu, 16 Jan 2020 07:52:08 +0100

A Diary of mine was published today on the SANS Internet Storm Center. In this one we take a look at what last year brought us, when it comes to malware delivered by e-mail, specifically at the smallest and largest malicious files I found in my e-mail quarantine.

SANS ISC Diary - E-mail from Agent Tesla

Jan Kopriva — Thu, 05 Dec 2019 07:30:00 +0100

A Diary of mine was published today on the SANS Internet Storm Center. In this one we take a look at a multi-stage downloader for Agent Tesla.

SANS ISC Diary - Analysis of a strangely poetic malware

Jan Kopriva — Wed, 04 Dec 2019 08:14:33 +0100

A Diary of mine was published today on the SANS Internet Storm Center. In this one we take a look at a macro-based dropper sent to the Internet Storm Center by one of our readers.

SANS ISC Diary - Did the recent malicious BlueKeep campaign have any positive impact when it comes to patching?

Jan Kopriva — Sun, 10 Nov 2019 11:55:40 +0100

A Diary of mine was published today on the SANS Internet Storm Center. If you wondered whether the recent “BlueKeep worm scare” had any impact when it comes to the number of vulnerable systems out there, then this one is for you.

EDIT 13/11/2019: Shaun from The Register liked the post and wrote an article based on it - you may find it here.

SANS ISC Diary - Phishing e-mail spoofing SPF-enabled domain

Jan Kopriva — Thu, 17 Oct 2019 11:49:25 +0200

A Diary of mine was published today on the SANS Internet Storm Center. In this one, we take a look at SPF and when even SPF-enabled domains may be spoofed.

SANS ISC Diary - Tricky LNK points to TrickBot

Jan Kopriva — Tue, 03 Sep 2019 13:06:21 +0200

A Guest Diary of mine was published today on the SANS Internet Storm Center. In this one, we take a look at analyzing a malicious LNK file which leads us to a sample of Trickbot.

It's 2019 and WannaCry is still not dead

Jan Kopriva — Wed, 30 Jan 2019 17:20:48 +0100

Unless you live completely cut off from the rest of human civilization, chances are good you’ve heard about the WannaCry ransomware. However, so we’re all on the same page, I’ll go over the salient points of its history before discussing why it is still a threat.

WannaCry - the first successful crypto-ransomware worm - started to spread on May 12th 2017 using the EternalBlue exploit and DoublePulsar backdoor implant (both courtesy of the Shadow Brokers and - by proxy - Equation Group/NSA) and supposedly hit more than 100 countries within the first 24 hours. Although the speed of spreading was nowhere near the famous SQL Slammer/Saphire/Helkern or even CodeRed levels, it was still quite impressive.

As it is usually the case when a new malware starts to succesfully spread, many researchers started analyzing samples of it. Among these researchers was also the controversial Markus Hutchins, who noticed that the malware used tried to query an at-that-time non-existant domain to decide if it should encrypt data and spread further when it infected any new computer.
Basically, it tried to connect to the www[.]iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com domain and if it succeeded, it didn’t encrypt any data nor did it spread further.

If fact, except for connecting to this domain on reboot to make sure it was there, the ransomware didn’t do much of anything from that point onward. It is unknown why this functionality was implemented in WannaCry (although there are a lot of theories - the two most popular ones considers it either an anti-sandboxing mechanism, or an intentional killswitch to stop the infection should the attacker wish it). However when Hutchins noticed this behaviour, he registered this domain and “sinkholed” it, which pretty much stopped WannaCry from spreading…until another version without this “killswitch” functionality was released, that is.

Although the number of infected computers was in the hundreds of thousands at least (see the chart bellow - especially the situation in China seems to have been quite interesitng), the outbreak was more or less dealt with within few weeks. Computers spreading WannaCry were disinfected, admins who didn’t do so before patched the vulnerability used by EternalBlue exploit and pretty much everyone considered WannaCry dealt with.

Source: [Bleeping Computer](https://www.bleepingcomputer.com/news/security/new-data-shows-most-wannacry-victims-are-from-china-not-russia/)

That however seems to be very far from the true state of affairs. Jamie Hankins from KryptosLogic (company which currently takes care of the killswitch domain) published couple of interesting charts based on monitoring of the killswitch in December. As these charts and other information from Hankins show, quite a large number of computers still try to connect to the killswitch domain every day. From the first chart bellow, you may see that during working hours on weekdays, there are between 500,000 and 600,000 requests detected every 3 hours. This indicates that there are still at least tens of thousands of computers infected by the original version of WannaCry. This is both unexpected and quite scary.

Source: [Jamie Hankins](https://twitter.com/2sec4u/status/1076151355759308800)

Since the killswitch domain works as it should, the ransomware doesn’t do anything malicious at the moment. But should the domain go down or be unaccesible for some reason, WannaCry on the infected computers would “wake up” again and continue with its normal operations, which would undoubtedly cause major problems to all affected subjects.

On the second chart bellow, you may see that most of the infected machines seem to be in Asia, however that doesn’t mean there are no infections still active in other regions.

Source: [Jamie Hankins](https://twitter.com/2sec4u/status/1076151355759308800)

So this is where we are now - we know WannaCry is still with us and still presents a potential threat. What can we do? It’s actually fairly simple. If you don’t have any security devices monitoring DNS and web traffic in place, try going through DNS logs for your infrastructure and try to find any lookups for the WannaCry killswitch domain. You probably won’t, but it’s better to be safe then sorry.

An if you still haven’t applied the MS17-010 update, well… in such a case WannaCry might not be your biggest concern, but it’d still recommend you apply the patch. After all, it’s better to do so more than 18 months late than never.

Looking back at October 2015

Jan Kopriva — Wed, 11 Nov 2015 21:14:53 +0100

October was named European Month of Cyber Security and because of that, many events intended to raise cyber security awareness (such as Security Fest in Prague) were held during the 30 day period. Unfortunately, October has seen just as many new developments on the proverbial “dark side” of cyber security.
One of these was a widely followed theft of personal data (including credit card numbers) of up to four milion customers of a British telecommunication service provider TalkTalk. Russian hacker group has claimed responsibility for the attack, however the end of the month has seen arrest of a small number of young men in Great Britain in connection with the theft.
The Stagefright vulnerability in the Android operating system has seen a new development with the discovery of a new vulnerability dubbed Stagefright 2.0. The vulnerability is due to a fault in a code used for accessing multimedia files and enables a potential attacker to execute arbitrary code on the affected device. According to some sources, the vulnerability might affect up to one bilion devices. Google has already published a patch for Stagefright 2.0, however since an update can not be provided for all Android-based devices, the vulnerability might provide to be an interesting vector of attack in the future.
A good final topic for “Looking back” dedicated to European Cyber Security Month might be the discovery of a new “malware” named Linux.Wifatch. It spreads by usual network vectors to vulnerable devices running Linux operating system and changes their configuration in a way which makes them harder for other malware to attack. The interesting point is that Wifatch performed no malicious actions on infected devices, as is documented by an interview with its authors.

Looking back at September 2015

Jan Kopriva — Sun, 18 Oct 2015 16:13:47 +0100

Information concerning number of devices vulnerable to Heartbleed vulnerability has appeared in the news during September. Given that the existence of Heartbleed was made public almost a year and a half ago it may be surprising that the number of vulnerable devices exceeds 200.000.
Affair concerning the Stagefright vulnerability (which was mentioned in the last Looking back) continued in September when Zimperium – the company which discovered Stagefright – released a proof-of-concept code which exploits the vulnerability.
A stealth malware hidden in modified Cisco IOS images and named SYNful knock has been discovered on tens of Cisco routers around the world. The malware functions as a backdoor and besides the (persistent) IOS-embedded main component uses tens of modules which provide further functionality which it loads into volatile memory.
It should be mentioned that Google, Microsoft and Mozzila made a press release announcing that their browsers will stop supporting the RC4 encryption algorithm early next year.
One final piece of interesting news we will mention has been the discovery of a malware targeted at online poker players. The trojan horse is named Odlanor and captures screenshots of applications used for playing poker online and then sends them to the attacker.

Looking back at August 2015

Jan Kopriva — Tue, 08 Sep 2015 17:06:42 +0100

One of the most important information related to cyber security pertains to August release of a patch for the Stagefright vulnerability, to which almost all versions of the Android OS from versions 2.2 to version 5.1 are vulnerable. The existence of Stagefright had been made public at the end of July and it is estimated that vulnerable device number in hundreds of millions. The vulnerability enables the attacker to cause arbitrary code execution by sending a specially crafted MMS. The released patch has unfortunately been shown to be incomplete, the result of which is that even updated devices are still vulnerable.
Another interesting vulnerability which also affects a mobile platform (in this case iOS) is called Ins0mnia. The vulnerability enables malicious applications to circumvent OS security controls and run in the background without users knowledge (and – for example – collect sensitive information). Ins0mnia affects even non-jailbroken devices and has been patched in the iOS 8.4.1 update.
One further August news story has been connected to Apple products – creation of the Thunderstrike 2.0 proof-of-concept worm which is able to infect firmware of Macs. Given the location of infected memory, it is highly problematic to detect the infection from the OS and removal of the worm requires firmware to be re-flashed.
Another newly discovered (however 18 years old) attack vector also exploits vulnerability connected to computer hardware. A vulnerability in Intel x86 processors enables an attacker to install rootkit into memory location used by SMM (System Management Mode – a privileged mode used outside of normal OS execution).
One final interesting news comes from the Czech Republic and concerns signing of a sectoral agreement about cyber security education between commercial and governmental entities.

Looking back at April 2015

Jan Kopriva — Sat, 09 May 2015 20:51:28 +0100

During April, we have witnessed - among others - a discovery of an 18 years old “Redirect to SMB” vulnerability which can be used to attack all versions of Windows released since then. The vulnerability can be exploited in cases when attacker has some control over the network, enabling him to gain user login information by redirecting of network traffic to a malicious SMB (server message block) server. The server forces the target to automatic authorization process during which the target sends users login, domain and hashed password.
Next to this vulnerability an April discovery of a modern macro malware BALTEX. It spreads using phishing messages with a link to a page containing an infected Word document and instructions to enable macros. After the downloaded document is opened, the macro downloads a variant of DYRE banking malware.
It is also worth mentioning that the RSA conference was held at the end of April.

Looking back at March 2015

Jan Kopriva — Wed, 01 Apr 2015 00:00:24 +0100

Looking back at March, probably the most important information security news has been discovery of a significant vulnerability (which could be exploited using a FREAK attack) in some TLS/SSL implementations, including the ones used by Windows operating systems.
Another worth while news has been a discovery of a new campaign aimed at energy sector companies in the Middle East. Trojan Laizok - a reconnaissance malware for gathering information about infected systems - has been used in the campaign, along with other malicious programs which have been modified for specific systems based on the information gathered by Laizok.
A mention should also be made about two very powerful DDoS attacks made during the second half of the month - first one was targeted at Greatfire.org and the second one at GitHub. According to published analysis China was the source of both attacks.
Finally, at the end of “Looking back” we shoud mention that in course of March the Rowhammer attack was made public. It is based on changing specific bits in memory by exploiting a weakness in DDR3 memories which leads to priviledge escalation.